Circles Technologies was established in Israel in 2011. In 2014 Francisco Partner acquired and merged it with NSO that it had acquired in the same year in a deal of 250 million Dollars. Circles sells its product to governments exclusively. Among the most important service provided by the company is the ability to intercept communications and determining the geographical location of any mobile phone through only its phone number. The company promotes that this service can reach any mobile phone in 6 seconds only. Circles exploits Signaling System 7 (SS7) for determining the geographic locations of the targeted device and intercepting communications. SS7 is a protocol used by domestic and international communications companies and enables roaming through the mobile phone line. To exploit this protocol for spying on individuals Circles created a fake company in 2015 under the name Circles Bulgaria, to be able to use this protocol in surveillance. The company also exploit SS7 protocol to infect the targeted devices with malware. Both UAE and Morocco use Circles products. Some document filed during lawsuit litigated in Israel against both Circles and NSO Group have shown correspondence between Circles and many clients in UAE, among these is the Emirati Supreme Council of National Security.
Country of Origin
Works with governments
Software and Equipment
Type of Attack
Targeting specific users
Technical Specifications of Software and Equipment
Circles sells a system that enables its clients to attach this system to the infrastructure of their telecom companies, or to use a separate system called Circles Cloud, which is a system that connects to telecom companies around the globe. Circles works by exploiting Signaling System 7 (SS7) protocol, a protocol used to exchange information and routing phone calls among different wired and wireless telecommunications companies. It manipulates it for determining the geographic location of the targeted person’s phone. It can also intercept audio calls, and short text messages, which in case of being intercepted the two-factor authentication codes sent through SMSs can also be intercepted. The company determines the geographic location only by using the phone number, by determining the cellular cell the phone is connected to and its location.